@aunucore/baileys 1.0.84 → 1.0.85

package/lib/Utils/index.d.ts

@@ -13,6 +13,7 @@ export * from './auth-utils.js';
 export * from './baileys-event-stream.js';
 export * from './use-multi-file-auth-state.js';
 export * from './link-preview.js';
+export * from './safe-fetch.js';
 export * from './event-buffer.js';
 export * from './process-message.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/Utils/index.js

@@ -31,6 +31,7 @@ export * from './auth-utils.js';
 export * from './baileys-event-stream.js';
 export * from './use-multi-file-auth-state.js';
 export * from './link-preview.js';
+export * from './safe-fetch.js';
 export * from './event-buffer.js';
 export * from './process-message.js';
 //# sourceMappingURL=index.js.map

package/lib/Utils/link-preview.js

@@ -1,15 +1,71 @@
 import { prepareWAMessageMedia } from './messages.js';
-import { extractImageThumb, getHttpStream } from './messages-media.js';
+import { extractImageThumb } from './messages-media.js';
+import { readImageDimensions, safeHttpGet } from './safe-fetch.js';
 const THUMBNAIL_WIDTH_PX = 192;
+// AunuBaileys (1.0.85): everything in this module is fetched on behalf
+// of a REMOTE PAGE — the URL comes from message text and the og:image
+// from the fetched page itself — so all of it now goes through the
+// SSRF-safe fetch (lib/Utils/safe-fetch.js): non-public addresses are
+// refused at connect time (peer-supplied URLs used to be able to make
+// the host GET loopback / RFC1918 / cloud-metadata addresses), and
+// every response is size- and time-bounded. link-preview-js is used
+// for HTML parsing ONLY (getPreviewFromContent); it no longer
+// performs any network access, so the protections do not depend on
+// the installed link-preview-js version. This also closes HB-205:
+// the HTML body used to be read in full with no cap and no overall
+// timeout (the library's abort timer covered only time-to-headers).
+const MAX_HTML_BYTES = 1024 * 1024; // og: tags live in <head>; the rest is cut off
+const MAX_THUMBNAIL_BYTES = 5 * 1024 * 1024;
+const MAX_THUMBNAIL_PIXELS = 40000000; // refuse decompression bombs before the image library sees them
+const MAX_PREVIEW_TIMEOUT_MS = 30000;
+const HTMLISH = /^(text\/html|application\/xhtml\+xml|text\/xml|application\/xml)\b/i;
+/** Only these keys of the caller's fetchOpts are honoured now. */
+const transportOpts = (fetchOpts = {}) => ({
+    // Sanitised at the boundary: a finite positive timeout is honored
+    // (clamped to a sane preview ceiling), anything else gets the
+    // historical 3000 ms default.
+    timeout: typeof fetchOpts.timeout === 'number' && Number.isFinite(fetchOpts.timeout) && fetchOpts.timeout > 0
+        ? Math.min(fetchOpts.timeout, MAX_PREVIEW_TIMEOUT_MS)
+        : 3000,
+    headers: fetchOpts.headers,
+    // Explicit, host-controlled hooks only — never derived from
+    // message content: an opt-in for deployments that really want
+    // previews of intranet links, and resolver/policy overrides.
+    allowPrivateNetworks: fetchOpts.allowPrivateNetworks === true,
+    isBlocked: typeof fetchOpts.isBlockedAddress === 'function' ? fetchOpts.isBlockedAddress : undefined,
+    lookup: typeof fetchOpts.lookup === 'function' ? fetchOpts.lookup : undefined
+});
+const decodeBody = (body, contentType) => {
+    const charset = /charset=["']?([\w-]+)/i.exec(contentType || '')?.[1];
+    try {
+        return new TextDecoder(charset || 'utf-8').decode(body);
+    }
+    catch {
+        return new TextDecoder('utf-8').decode(body);
+    }
+};
+/** Fetches an og:image through the safe fetch, with byte + pixel bounds. */
+const fetchThumbnailBuffer = async (imageUrl, fetchOpts) => {
+    const res = await safeHttpGet(imageUrl, {
+        ...transportOpts(fetchOpts),
+        maxBytes: MAX_THUMBNAIL_BYTES,
+        onLimit: 'throw'
+    });
+    const dims = readImageDimensions(res.body);
+    if (dims && dims.width * dims.height > MAX_THUMBNAIL_PIXELS) {
+        throw new Error(`thumbnail dimensions ${dims.width}x${dims.height} exceed the safety limit`);
+    }
+    return res.body;
+};
 /** Fetches an image and generates a thumbnail for it */
-// AunuBaileys (1.0.72): an og:image only ever becomes a small JPEG —
-// cap the source download instead of buffering a hostile endless
-// stream in full (HB-89). getUrlInfo catches thumbnail errors and
-// degrades to no thumbnail.
-const MAX_THUMBNAIL_SOURCE_BYTES = 8 * 1024 * 1024;
 const getCompressedJpegThumbnail = async (url, { thumbnailWidth, fetchOpts }) => {
-    const stream = await getHttpStream(url, fetchOpts);
-    const result = await extractImageThumb(stream, thumbnailWidth, MAX_THUMBNAIL_SOURCE_BYTES);
+    // AunuBaileys (1.0.72): an og:image only ever becomes a small
+    // JPEG — cap the source download instead of buffering a hostile
+    // endless stream in full (HB-89). (1.0.85): the cap is now
+    // enforced by the safe fetch (5 MiB, throw) before the bytes
+    // reach the image library, and pixel bombs are refused up front.
+    const buffer = await fetchThumbnailBuffer(url, fetchOpts);
+    const result = await extractImageThumb(buffer, thumbnailWidth);
     return result;
 };
 /**
@@ -23,34 +79,22 @@ export const getUrlInfo = async (text, opts = {
     fetchOpts: { timeout: 3000 }
 }) => {
     try {
-        // retries
-        const retries = 0;
-        const maxRetry = 5;
-        const { getLinkPreview } = await import('link-preview-js');
+        const { getPreviewFromContent } = await import('link-preview-js');
         let previewLink = text;
         if (!text.startsWith('https://') && !text.startsWith('http://')) {
             previewLink = 'https://' + previewLink;
         }
-        const info = await getLinkPreview(previewLink, {
-            ...opts.fetchOpts,
-            followRedirects: 'follow',
-            handleRedirects: (baseURL, forwardedURL) => {
-                const urlObj = new URL(baseURL);
-                const forwardedURLObj = new URL(forwardedURL);
-                if (retries >= maxRetry) {
-                    return false;
-                }
-                if (forwardedURLObj.hostname === urlObj.hostname ||
-                    forwardedURLObj.hostname === 'www.' + urlObj.hostname ||
-                    'www.' + forwardedURLObj.hostname === urlObj.hostname) {
-                    retries + 1;
-                    return true;
-                }
-                else {
-                    return false;
-                }
-            },
-            headers: opts.fetchOpts
+        const res = await safeHttpGet(previewLink, {
+            ...transportOpts(opts.fetchOpts),
+            maxBytes: MAX_HTML_BYTES,
+            onLimit: 'truncate',
+            shouldReadBody: (_status, headers) => !headers['content-type'] || HTMLISH.test(headers['content-type'])
+        });
+        const contentType = res.headers['content-type'];
+        const info = await getPreviewFromContent({
+            url: res.url,
+            data: decodeBody(res.body, contentType),
+            headers: contentType ? { 'content-type': contentType } : {}
         });
         if (info && 'title' in info && info.title) {
             const [image] = info.images;
@@ -61,8 +105,16 @@ export const getUrlInfo = async (text, opts = {
                 description: info.description,
                 originalThumbnailUrl: image
             };
-            if (opts.uploadImage) {
-                const { imageMessage } = await prepareWAMessageMedia({ image: { url: image } }, {
+            if (opts.uploadImage && image) {
+                // AunuBaileys (1.0.85): the high-quality thumbnail is
+                // fetched through the safe fetch as a Buffer instead
+                // of handing the page-supplied URL to the generic
+                // media pipeline. The `&& image` guard also closes
+                // HB-150: a page without an og:image used to explode
+                // here with a raw TypeError and lose the whole
+                // preview.
+                const thumb = await fetchThumbnailBuffer(image, opts.fetchOpts);
+                const { imageMessage } = await prepareWAMessageMedia({ image: thumb }, {
                     upload: opts.uploadImage,
                     mediaTypeOverride: 'thumbnail-link',
                     options: opts.fetchOpts
@@ -87,4 +139,4 @@ export const getUrlInfo = async (text, opts = {
         }
     }
 };
-//# sourceMappingURL=link-preview.js.map
+//# sourceMappingURL=link-preview.js.map

package/lib/Utils/messages-media.js

@@ -97,6 +97,15 @@ export async function getMediaKeys(buffer, mediaType) {
     };
 }
 /** Extracts video thumb using FFMPEG */
+// AunuBaileys (1.0.85, HB-128): ffmpeg used to run with NO timeout
+// and NO kill, accumulating stderr without bound — a wedged ffmpeg
+// hung generateThumbnail, and with it the Promise.all inside
+// prepareWAMessageMedia, so the video send never settled; a chatty
+// ffmpeg could also grow stderr in memory without limit. Bound
+// both: SIGKILL after the timeout, and keep only the first 64 KiB
+// of stderr (plenty for the error message).
+const FFMPEG_THUMB_TIMEOUT_MS = 30000;
+const FFMPEG_STDERR_CAP_BYTES = 64 * 1024;
 const extractVideoThumb = async (path, destPath, time, size) => new Promise((resolve, reject) => {
     // AunuBaileys: spawn dengan array argumen, tanpa shell (dari @itsliaaa/baileys) —
     // path/waktu/ukuran tidak lagi diinterpolasi ke string perintah shell
@@ -110,12 +119,33 @@ const extractVideoThumb = async (path, destPath, time, size) => new Promise((res
         destPath
     ], { stdio: ['ignore', 'ignore', 'pipe'] });
     const stderrChunks = [];
-    ffmpeg.stderr.on('data', (chunk) => stderrChunks.push(chunk));
-    ffmpeg.on('error', reject);
+    let stderrBytes = 0;
+    ffmpeg.stderr.on('data', (chunk) => {
+        if (stderrBytes >= FFMPEG_STDERR_CAP_BYTES) {
+            return;
+        }
+        const keep = chunk.subarray(0, FFMPEG_STDERR_CAP_BYTES - stderrBytes);
+        stderrChunks.push(keep);
+        stderrBytes += keep.length;
+    });
+    let timedOut = false;
+    const timer = setTimeout(() => {
+        timedOut = true;
+        ffmpeg.kill('SIGKILL');
+    }, FFMPEG_THUMB_TIMEOUT_MS);
+    timer.unref?.();
+    ffmpeg.on('error', (err) => {
+        clearTimeout(timer);
+        reject(err);
+    });
     ffmpeg.on('close', (code) => {
+        clearTimeout(timer);
         if (code === 0) {
             resolve();
         }
+        else if (timedOut) {
+            reject(new Error(`ffmpeg timed out after ${FFMPEG_THUMB_TIMEOUT_MS}ms while extracting a video thumbnail`));
+        }
         else {
             reject(new Error(`ffmpeg exited with code ${code}: ${Buffer.concat(stderrChunks).toString('utf8').trim()}`));
         }
@@ -179,6 +209,10 @@ export const extractImageThumb = async (bufferOrFilePath, width = 32, maxBytes)
     }
 };
 export const encodeBase64EncodedStringForUpload = (b64) => encodeURIComponent(b64.replace(/\+/g, '-').replace(/\//g, '_').replace(/\=+$/, ''));
+// AunuBaileys (1.0.85, HB-219): bounds for the remote fetch in
+// generateProfilePicture (16 MiB matches the product-image cap).
+const MAX_PROFILE_PICTURE_SOURCE_BYTES = 16 * 1024 * 1024;
+const PROFILE_PICTURE_FETCH_TIMEOUT_MS = 30000;
 export const generateProfilePicture = async (mediaUpload, dimensions) => {
     let buffer;
     const { width: w = 640, height: h = 640 } = dimensions || {};
@@ -187,9 +221,16 @@ export const generateProfilePicture = async (mediaUpload, dimensions) => {
     }
     else {
         // Use getStream to handle all WAMediaUpload types (Buffer, Stream, URL)
-        const { stream } = await getStream(mediaUpload);
-        // Convert the resulting stream to a buffer
-        buffer = await toBuffer(stream);
+        // AunuBaileys (1.0.85, HB-219): a remote URL used to be
+        // buffered with NO size cap and NO timeout — a huge or
+        // never-ending response was accumulated in full before the
+        // image decode finally rejected it (verified: 12 MB of junk
+        // buffered whole, RSS +53 MB), and a stalled server hung
+        // updateProfilePicture forever. Bound both, like the
+        // sticker-pack and product-image paths already do.
+        const { stream } = await getStream(mediaUpload, { timeout: PROFILE_PICTURE_FETCH_TIMEOUT_MS });
+        // Convert the resulting stream to a buffer, with a hard cap
+        buffer = await toBufferWithLimit(stream, MAX_PROFILE_PICTURE_SOURCE_BYTES);
     }
     const lib = await getImageProcessingLibrary();
     let img;
@@ -323,9 +364,20 @@ export const getStream = async (item, opts) => {
     if (Buffer.isBuffer(item)) {
         return { stream: toReadable(item), type: 'buffer' };
     }
+    // AunuBaileys (1.0.85, HB-208): unusable media used to explode
+    // here as raw TypeErrors — 'stream' in undefined/null for a
+    // missing media value, a toString deref for an object with no
+    // usable url, a createReadStream type error for a numeric url.
+    // Reject all of them with a clear Boom 400 instead.
+    if (!item || typeof item !== 'object') {
+        throw new Boom('Invalid media: expected a Buffer, a stream, or an object with a url', { statusCode: 400 });
+    }
     if ('stream' in item) {
         return { stream: item.stream, type: 'readable' };
     }
+    if (typeof item.url !== 'string' && !(item.url instanceof URL)) {
+        throw new Boom('Invalid media: expected a Buffer, a stream, or an object with a url', { statusCode: 400 });
+    }
     const urlStr = item.url.toString();
     if (urlStr.startsWith('data:')) {
         const comma = urlStr.indexOf(',');
@@ -533,7 +585,17 @@ export const encryptedStream = async (media, mediaType, { logger, saveOriginalFi
                 }
             }
             if (streamableVerdict === null) {
-                head = Buffer.concat([head, data]);
+                // AunuBaileys (1.0.85, HB-220): the scan only ever
+                // reads the leading ~1 KiB (it decides from box
+                // headers/sizes in that prefix and forces a verdict
+                // past AUNU_SIDECAR_SCAN_MAX_BYTES), but the WHOLE
+                // chunk used to be concatenated into `head` and held
+                // for the entire call — and for Buffer input the
+                // whole media arrives as ONE chunk, so `head` was a
+                // full second copy of the media (measured: ~+88 MB
+                // peak RSS on a 48 MB video). Retain only the prefix
+                // the scan can consume; its verdicts are unchanged.
+                head = Buffer.concat([head, data]).subarray(0, AUNU_SIDECAR_SCAN_MAX_BYTES + 32);
                 streamableVerdict = aunuScanStreamable(head);
                 if (streamableVerdict === null && head.length > AUNU_SIDECAR_SCAN_MAX_BYTES) {
                     streamableVerdict = true;
@@ -735,20 +797,37 @@ export const downloadEncryptedContent = async (downloadUrl, { cipherKey, iv, mac
             const decryptLength = toSmallestChunkSize(data.length);
             remainingBytes = data.slice(decryptLength);
             data = data.slice(0, decryptLength);
-            if (!aes) {
-                let ivValue = iv;
-                if (firstBlockIsIV) {
-                    ivValue = data.slice(0, AES_CHUNK_SIZE);
-                    data = data.slice(AES_CHUNK_SIZE);
-                }
-                aes = Crypto.createDecipheriv('aes-256-cbc', cipherKey, ivValue);
-                // if an end byte that is not EOF is specified
-                // stop auto padding (PKCS7) -- otherwise throws an error for decryption
-                if (endByte) {
-                    aes.setAutoPadding(false);
-                }
-            }
             try {
+                if (!aes) {
+                    // AunuBaileys (1.0.85, HB-114/HB-158): on the
+                    // ranged path the IV is carved out of the first
+                    // 16 bytes of the body — when the first chunk(s)
+                    // total less than that, there is nothing to build
+                    // a decipher from yet. createDecipheriv used to
+                    // sit OUTSIDE this try and threw a bare
+                    // "Invalid initialization vector" TypeError for
+                    // exactly that download. Wait for more bytes
+                    // instead (a <16-byte slice means decryptLength
+                    // was 0, so everything is still in
+                    // remainingBytes), and keep the construction
+                    // inside the try so any failure surfaces as a
+                    // proper stream error with context.
+                    if (firstBlockIsIV && data.length < AES_CHUNK_SIZE) {
+                        callback();
+                        return;
+                    }
+                    let ivValue = iv;
+                    if (firstBlockIsIV) {
+                        ivValue = data.slice(0, AES_CHUNK_SIZE);
+                        data = data.slice(AES_CHUNK_SIZE);
+                    }
+                    aes = Crypto.createDecipheriv('aes-256-cbc', cipherKey, ivValue);
+                    // if an end byte that is not EOF is specified
+                    // stop auto padding (PKCS7) -- otherwise throws an error for decryption
+                    if (endByte) {
+                        aes.setAutoPadding(false);
+                    }
+                }
                 pushBytes(aes.update(data), b => this.push(b));
                 callback();
             }
@@ -807,8 +886,18 @@ export function extensionForMediaMessage(message) {
     }
     return extension;
 }
+// AunuBaileys (1.0.85, HB-127): default ceiling for one media-upload POST.
+const MEDIA_UPLOAD_DEFAULT_TIMEOUT_MS = 120000;
 export const getWAUploadToServer = ({ customUploadHosts, fetchAgent, logger, options }, refreshMediaConn) => {
     return async (filePath, { mediaType, fileEncSha256B64, timeoutMs, newsletter }) => {
+        // AunuBaileys (1.0.85, HB-127): timeoutMs used to be a pure
+        // pass-through of the host's mediaUploadTimeoutMs, with no
+        // default anywhere — an upload host that black-holes the
+        // connection (accepts TCP, never speaks) left the POST, and
+        // with it prepareWAMessageMedia -> sendMessage, pending
+        // FOREVER. Sanitise at the boundary: a finite positive
+        // value is honored, anything else gets the default.
+        const effectiveTimeoutMs = typeof timeoutMs === 'number' && Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : MEDIA_UPLOAD_DEFAULT_TIMEOUT_MS;
         // send a query JSON to obtain the url & auth token to upload our media
         let uploadInfo = await refreshMediaConn(false);
         let urls;
@@ -837,7 +926,7 @@ export const getWAUploadToServer = ({ customUploadHosts, fetchAgent, logger, opt
                         Origin: DEFAULT_ORIGIN
                     },
                     httpsAgent: fetchAgent,
-                    timeout: timeoutMs,
+                    timeout: effectiveTimeoutMs,
                     responseType: 'json',
                     maxBodyLength: Infinity,
                     maxContentLength: Infinity
@@ -858,6 +947,20 @@ export const getWAUploadToServer = ({ customUploadHosts, fetchAgent, logger, opt
             catch (error) {
                 if (axios.isAxiosError(error)) {
                     result = error.response?.data;
+                    // AunuBaileys (1.0.85, HB-137): a 401/403 means
+                    // the media auth itself is stale. The no-URL
+                    // branch above already force-refreshes in that
+                    // situation, but this error branch kept retrying
+                    // the remaining hosts with the SAME dead auth —
+                    // and every later send reused the cached conn
+                    // until its TTL expired by the local clock, so
+                    // all media sends kept failing. Refresh
+                    // (best-effort: a failed refresh keeps the old
+                    // info) so the next host — and the next send —
+                    // uses fresh auth.
+                    if (error.response?.status === 401 || error.response?.status === 403) {
+                        uploadInfo = await refreshMediaConn(true).catch(() => uploadInfo);
+                    }
                 }
                 const isLast = hostname === hosts[uploadInfo.hosts.length - 1]?.hostname;
                 logger.warn({ trace: error.stack, uploadResult: result }, `Error in uploading to ${hostname} ${isLast ? '' : ', retrying...'}`);

package/lib/Utils/messages.js

@@ -94,6 +94,17 @@ export const prepareWAMessageMedia = async (message, options) => {
         media: message[mediaType]
     };
     delete uploadData[mediaType];
+    // AunuBaileys (1.0.85, HB-208 + addendum): reject an unusable
+    // media value HERE, before the cacheable-key computation below
+    // derefs it — a null media used to explode in that computation
+    // itself ('url' in null), and undefined / non-object media as a
+    // raw TypeError further down in getStream. Hosts get a clear
+    // Boom 400 at the boundary instead. ({} and { url: undefined }
+    // pass this check and are rejected by the matching getStream
+    // guard.)
+    if (typeof uploadData.media !== 'object' || uploadData.media === null) {
+        throw new Boom(`Invalid media for "${mediaType}": expected a Buffer, a stream, or an object with a url`, { statusCode: 400 });
+    }
     // check if cacheable + generate cache key
     const cacheableKey = typeof uploadData.media === 'object' &&
         'url' in uploadData.media &&
@@ -421,15 +432,25 @@ async function prepareStickerPackMessage(stickerPack, options) {
                 // AunuBaileys (1.0.71): only load the image library when
                 // a non-WebP sticker actually needs converting — pure
                 // WebP packs used to pay the import cost for nothing.
-                const { sharp } = await loadLib();
-                if (sharp) {
+                const imgLib = await loadLib();
+                if ('sharp' in imgLib && imgLib.sharp) {
                     // Convert to WebP, preserving metadata
-                    webpBuffer = await sharp.default(buffer).webp().toBuffer();
+                    webpBuffer = await imgLib.sharp.default(buffer).webp().toBuffer();
                     // Non-WebP inputs converted to WebP are not animated
                     isAnimated = false;
                 }
+                else if ('image' in imgLib && imgLib.image?.Transformer) {
+                    // AunuBaileys (1.0.85, HB-164): the @napi-rs/image
+                    // backend converts to WebP fine (extractImageThumb
+                    // already uses it) — the pack path used to ignore
+                    // it, so a host with @napi-rs/image but no sharp
+                    // failed EVERY non-WebP sticker (and an all-PNG
+                    // pack failed outright via HB-97).
+                    webpBuffer = await new imgLib.image.Transformer(buffer).webp();
+                    isAnimated = false;
+                }
                 else {
-                    throw new Boom('No image processing library (sharp) available for converting sticker to WebP. Either install sharp or provide stickers in WebP format.');
+                    throw new Boom('No image processing library (sharp or @napi-rs/image) available for converting sticker to WebP. Either install sharp or @napi-rs/image, or provide stickers in WebP format.');
                 }
             }
             if (webpBuffer.length > 1024 * 1024) {
@@ -474,12 +495,17 @@ async function prepareStickerPackMessage(stickerPack, options) {
         coverWebpBuffer = coverBuffer;
     }
     else {
-        const { sharp } = await loadLib();
-        if (sharp) {
-            coverWebpBuffer = await sharp.default(coverBuffer).webp().toBuffer();
+        const coverLib = await loadLib();
+        if ('sharp' in coverLib && coverLib.sharp) {
+            coverWebpBuffer = await coverLib.sharp.default(coverBuffer).webp().toBuffer();
+        }
+        else if ('image' in coverLib && coverLib.image?.Transformer) {
+            // AunuBaileys (1.0.85, HB-164): @napi-rs/image backend,
+            // same gap as the sticker conversion above.
+            coverWebpBuffer = await new coverLib.image.Transformer(coverBuffer).webp();
         }
         else {
-            throw new Boom('No image processing library (sharp) available for converting cover to WebP. Either install sharp or provide cover in WebP format.');
+            throw new Boom('No image processing library (sharp or @napi-rs/image) available for converting cover to WebP. Either install sharp or @napi-rs/image, or provide cover in WebP format.');
         }
     }
     // Add cover to ZIP data
@@ -539,6 +565,13 @@ async function prepareStickerPackMessage(stickerPack, options) {
         if ('sharp' in lib && lib.sharp) {
             thumbnailBuffer = await lib.sharp.default(coverBuffer).resize(252, 252).jpeg().toBuffer();
         }
+        else if ('image' in lib && lib.image?.Transformer) {
+            // AunuBaileys (1.0.85, HB-164): @napi-rs/image backend —
+            // the thumbnail used to fall through to a throw (and a
+            // silently dropped pack thumbnail) on hosts whose only
+            // image library is @napi-rs/image.
+            thumbnailBuffer = await new lib.image.Transformer(coverBuffer).resize(252, 252).jpeg(50);
+        }
         else if ('jimp' in lib && lib.jimp) {
             const jimpImage = await lib.jimp.Jimp.read(coverBuffer);
             thumbnailBuffer = await jimpImage.resize({ w: 252, h: 252 }).getBuffer('image/jpeg');
@@ -1603,6 +1636,15 @@ export const downloadMediaMessage = async (message, type, options, ctx) => {
         }
         const contentType = getContentType(mContent);
         let mediaType = contentType?.replace('Message', '');
+        // AunuBaileys (1.0.85, HB-252): the content type derives
+        // 'stickerPack' from stickerPackMessage, but the HKDF info
+        // mapping only knows the upload-side name 'sticker-pack' —
+        // downloads derived their keys from 'WhatsApp undefined
+        // Keys' and ALWAYS failed with a misleading bad-decrypt
+        // error. Normalise to the name the pack was encrypted with.
+        if (mediaType === 'stickerPack') {
+            mediaType = 'sticker-pack';
+        }
         const media = mContent[contentType];
         if (!media || typeof media !== 'object' || (!('url' in media) && !('thumbnailDirectPath' in media))) {
             throw new Boom(`"${contentType}" message is not a media message`);

package/lib/Utils/safe-fetch.d.ts

@@ -0,0 +1,57 @@
+import type { LookupFunction } from 'net';
+export declare class SafeFetchError extends Error {
+    code: string;
+    host?: string;
+    address?: string;
+    statusCode?: number;
+    limit?: number;
+    constructor(code: string, message: string, extra?: Record<string, unknown>);
+}
+export declare const SAFE_FETCH_DEFAULTS: Readonly<{
+    timeout: 3000;
+    maxRedirects: 5;
+    maxBytes: number;
+}>;
+/** true when `address` must never be contacted. Unparseable input is blocked (fail closed). */
+export declare const isBlockedAddress: (address: string) => boolean;
+export declare const createGuardedLookup: (opts?: {
+    lookup?: LookupFunction;
+    isBlocked?: (address: string) => boolean;
+}) => LookupFunction;
+export type SafeHttpGetOptions = {
+    /** idle/connect timeout per hop in ms (default 3000) */
+    timeout?: number;
+    /** hard deadline for the whole call incl. redirects (default 3 x timeout) */
+    totalTimeout?: number;
+    /** response cap in bytes, applied after decompression (default 1 MiB) */
+    maxBytes?: number;
+    /** 'throw' (default) or 'truncate' when the cap is hit */
+    onLimit?: 'throw' | 'truncate';
+    /** default 5 */
+    maxRedirects?: number;
+    /** 'any' (default) | 'same-host' | 'none'. Every hop is address-checked either way. */
+    redirects?: 'any' | 'same-host' | 'none';
+    headers?: Record<string, string>;
+    /** return false to skip downloading the body */
+    shouldReadBody?: (status: number, headers: Record<string, string>) => boolean;
+    /** explicit opt-out of the address policy (default false) */
+    allowPrivateNetworks?: boolean;
+    /** injection points (host hooks, tests) */
+    lookup?: LookupFunction;
+    isBlocked?: (address: string) => boolean;
+};
+export type SafeHttpGetResult = {
+    url: string;
+    status: number;
+    headers: Record<string, string>;
+    body: Buffer;
+    truncated: boolean;
+    redirects: number;
+};
+export declare function safeHttpGet(input: string | URL, options?: SafeHttpGetOptions): Promise<SafeHttpGetResult>;
+/** Reads width/height from PNG, GIF, JPEG and WebP headers without decoding. null if unknown. */
+export declare const readImageDimensions: (buf: Buffer) => {
+    width: number;
+    height: number;
+} | null;
+//# sourceMappingURL=safe-fetch.d.ts.map

package/lib/Utils/safe-fetch.js

@@ -0,0 +1,466 @@
+// AunuBaileys (1.0.85): hardened HTTP(S) GET for everything the library
+// fetches on behalf of a REMOTE PAGE — link previews and their
+// thumbnails. The URL (and every redirect target) is attacker-
+// controlled there: a chat peer can put any URL in a message, and the
+// socket generates a preview for outgoing text automatically. The old
+// path handed the fetch to link-preview-js, which resolved and
+// connected wherever the URL pointed — loopback, RFC1918 and the
+// 169.254 cloud-metadata address included (SSRF; the link-preview-js
+// advisories GHSA-4gp8-rjrq-ch6q / GHSA-cpjf-6666-r8fx are the same
+// class), and read the body with no size bound and no overall
+// timeout (HB-205). This module therefore:
+//   * resolves DNS itself and rejects non-public addresses AT
+//     CONNECT TIME, via a guarded lookup: the address that was
+//     validated is the address the socket connects to, so DNS
+//     rebinding (the answer changing between "check" and "use") is
+//     impossible by construction;
+//   * checks IP-literal hosts (IPv4 in any notation the URL parser
+//     produces, IPv6, IPv4-mapped / NAT64 / 6to4 embeddings);
+//   * follows redirects manually, re-validating every hop, with a
+//     hop limit, and always refuses an https -> http downgrade;
+//   * bounds the response size (after decompression), the total
+//     time and the per-hop idle time.
+// Design follows the pattern proven by xdc-baileys' safe-fetch
+// (reviewed statically in heartbeat run-0110); the redirect policy
+// differs on purpose: redirects are followed across hosts ('any',
+// max 5), because that is what this tree has always done via
+// undici — the SSRF protection comes from validating every hop's
+// address, not from pinning the host.
+import dns from 'node:dns';
+import http from 'node:http';
+import https from 'node:https';
+import net from 'node:net';
+import zlib from 'node:zlib';
+export class SafeFetchError extends Error {
+    constructor(code, message, extra = {}) {
+        super(message);
+        this.name = 'SafeFetchError';
+        this.code = code;
+        Object.assign(this, extra);
+    }
+}
+export const SAFE_FETCH_DEFAULTS = Object.freeze({
+    timeout: 3000,
+    maxRedirects: 5,
+    maxBytes: 1024 * 1024
+});
+// ------------------------------------------------------------------
+// address policy
+const parseIPv4 = (s) => {
+    if (typeof s !== 'string' || !net.isIPv4(s)) {
+        return null;
+    }
+    return s.split('.').map(Number);
+};
+const parseIPv6 = (input) => {
+    if (typeof input !== 'string') {
+        return null;
+    }
+    let s = input.trim().toLowerCase();
+    if (s.startsWith('[') && s.endsWith(']')) {
+        s = s.slice(1, -1);
+    }
+    s = s.split('%')[0];
+    if (!net.isIPv6(s)) {
+        return null;
+    }
+    if (s.includes('.')) {
+        const cut = s.lastIndexOf(':');
+        const v4 = parseIPv4(s.slice(cut + 1));
+        if (!v4) {
+            return null;
+        }
+        s = s.slice(0, cut + 1) + ((v4[0] << 8) | v4[1]).toString(16) + ':' + ((v4[2] << 8) | v4[3]).toString(16);
+    }
+    const parts = s.split('::');
+    if (parts.length > 2) {
+        return null;
+    }
+    const left = parts[0] ? parts[0].split(':') : [];
+    const right = parts.length === 2 && parts[1] ? parts[1].split(':') : [];
+    let groups;
+    if (parts.length === 2) {
+        const fill = 8 - left.length - right.length;
+        if (fill < 0) {
+            return null;
+        }
+        groups = [...left, ...Array(fill).fill('0'), ...right];
+    }
+    else {
+        groups = left;
+    }
+    if (groups.length !== 8) {
+        return null;
+    }
+    const bytes = [];
+    for (const g of groups) {
+        if (!/^[0-9a-f]{1,4}$/.test(g)) {
+            return null;
+        }
+        const n = parseInt(g, 16);
+        bytes.push(n >> 8, n & 255);
+    }
+    return bytes;
+};
+const isBlockedV4 = ([a, b, c]) => a === 0 || // 0.0.0.0/8 "this network"
+    a === 10 || // private
+    a === 127 || // loopback
+    (a === 100 && b >= 64 && b <= 127) || // CGNAT 100.64.0.0/10
+    (a === 169 && b === 254) || // link-local, cloud metadata
+    (a === 172 && b >= 16 && b <= 31) || // private
+    (a === 192 && b === 0 && c === 0) || // IETF protocol assignments
+    (a === 192 && b === 0 && c === 2) || // TEST-NET-1
+    (a === 192 && b === 88 && c === 99) || // 6to4 relay anycast
+    (a === 192 && b === 168) || // private
+    (a === 198 && (b === 18 || b === 19)) || // benchmarking
+    (a === 198 && b === 51 && c === 100) || // TEST-NET-2
+    (a === 203 && b === 0 && c === 113) || // TEST-NET-3
+    a >= 224; // multicast, reserved, broadcast
+const isBlockedV6 = (x) => {
+    const zero = (from, to) => x.slice(from, to).every(v => v === 0);
+    if (zero(0, 10) && x[10] === 0xff && x[11] === 0xff) {
+        return isBlockedV4(x.slice(12)); // ::ffff:a.b.c.d
+    }
+    if (zero(0, 12)) {
+        return true; // ::, ::1, ::a.b.c.d
+    }
+    if (x[0] === 0x00 && x[1] === 0x64 && x[2] === 0xff && x[3] === 0x9b) {
+        if (zero(4, 12)) {
+            return isBlockedV4(x.slice(12)); // 64:ff9b::/96 NAT64
+        }
+        if (x[4] === 0x00 && x[5] === 0x01) {
+            return true; // 64:ff9b:1::/48 local-use
+        }
+    }
+    if (x[0] === 0x20 && x[1] === 0x02) {
+        return isBlockedV4(x.slice(2, 6)); // 2002::/16 6to4
+    }
+    if (x[0] === 0x20 && x[1] === 0x01 && (x[2] & 0xfe) === 0) {
+        return true; // 2001::/23 (Teredo, benchmarking, ORCHID)
+    }
+    if (x[0] === 0x20 && x[1] === 0x01 && x[2] === 0x0d && x[3] === 0xb8) {
+        return true; // 2001:db8::/32 documentation
+    }
+    if (x[0] === 0x3f && x[1] === 0xff && (x[2] & 0xf0) === 0) {
+        return true; // 3fff::/20 documentation
+    }
+    if (x[0] === 0x01 && zero(1, 8)) {
+        return true; // 100::/64 discard-only
+    }
+    if (x[0] === 0x5f) {
+        return true; // 5f00::/16 SRv6 SIDs
+    }
+    if ((x[0] & 0xfe) === 0xfc) {
+        return true; // fc00::/7 unique-local
+    }
+    if (x[0] === 0xfe && (x[1] & 0xc0) >= 0x80) {
+        return true; // fe80::/10 link-local, fec0::/10 site-local
+    }
+    if (x[0] === 0xff) {
+        return true; // multicast
+    }
+    return false;
+};
+/** true when `address` must never be contacted. Unparseable input is blocked (fail closed). */
+export const isBlockedAddress = (address) => {
+    const v4 = parseIPv4(address);
+    if (v4) {
+        return isBlockedV4(v4);
+    }
+    const v6 = parseIPv6(address);
+    if (v6) {
+        return isBlockedV6(v6);
+    }
+    return true;
+};
+const blockedError = (host, address) => new SafeFetchError('ERR_SSRF_BLOCKED', `refusing to connect to non-public address (${host} -> ${address})`, { host, address });
+/**
+ * dns.lookup-compatible function used as the socket's `lookup`. Fails
+ * closed: if ANY resolved address is non-public the whole lookup is
+ * rejected, so a mixed answer cannot smuggle one in.
+ */
+export const createGuardedLookup = ({ lookup = dns.lookup, isBlocked = isBlockedAddress } = {}) => (hostname, options, callback) => {
+    if (typeof options === 'function') {
+        callback = options;
+        options = {};
+    }
+    const opts = typeof options === 'number' ? { family: options } : { ...(options || {}) };
+    lookup(hostname, { ...opts, all: true }, (err, addresses) => {
+        if (err) {
+            return callback(err);
+        }
+        const list = Array.isArray(addresses) ? addresses : [{ address: addresses, family: net.isIPv6(addresses) ? 6 : 4 }];
+        if (!list.length) {
+            return callback(Object.assign(new Error(`getaddrinfo ENOTFOUND ${hostname}`), { code: 'ENOTFOUND' }));
+        }
+        for (const { address } of list) {
+            if (isBlocked(address)) {
+                return callback(blockedError(hostname, address));
+            }
+        }
+        if (opts.all) {
+            return callback(null, list);
+        }
+        callback(null, list[0].address, list[0].family);
+    });
+};
+// ------------------------------------------------------------------
+// helpers
+const hostOf = (url) => url.hostname.startsWith('[') ? url.hostname.slice(1, -1) : url.hostname;
+const sameSite = (a, b) => {
+    const x = a.hostname.toLowerCase();
+    const y = b.hostname.toLowerCase();
+    return x === y || x === 'www.' + y || 'www.' + x === y;
+};
+const SENSITIVE_HEADERS = ['authorization', 'cookie', 'proxy-authorization'];
+const normalizeUrl = (input) => {
+    let url;
+    try {
+        url = input instanceof URL ? new URL(input.href) : new URL(String(input));
+    }
+    catch {
+        throw new SafeFetchError('ERR_INVALID_URL', 'invalid URL');
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new SafeFetchError('ERR_INVALID_URL', `unsupported protocol ${url.protocol}`);
+    }
+    if (url.username || url.password) {
+        throw new SafeFetchError('ERR_INVALID_URL', 'URLs with embedded credentials are not allowed');
+    }
+    return url;
+};
+const DECODERS = {
+    gzip: zlib.createGunzip,
+    'x-gzip': zlib.createGunzip,
+    deflate: zlib.createInflate,
+    br: zlib.createBrotliDecompress
+};
+const lowerHeaders = (h = {}) => {
+    const out = {};
+    for (const [k, v] of Object.entries(h)) {
+        if (v !== undefined && v !== null) {
+            out[k.toLowerCase()] = v;
+        }
+    }
+    return out;
+};
+// ------------------------------------------------------------------
+// transport + body reader
+const nodeTransport = ({ lookup, timeout }) => (url, headers, signal) => new Promise((resolve, reject) => {
+    const mod = url.protocol === 'https:' ? https : http;
+    const req = mod.request(url, {
+        method: 'GET',
+        headers,
+        lookup,
+        signal,
+        agent: false,
+        timeout,
+        maxHeaderSize: 16 * 1024
+    }, (res) => resolve({ status: res.statusCode, headers: res.headers, stream: res, decoded: false }));
+    req.on('timeout', () => req.destroy(new SafeFetchError('ERR_TIMEOUT', 'request timed out')));
+    req.on('error', reject);
+    req.end();
+});
+const readBody = async (hop, { maxBytes, onLimit, signal }) => {
+    const encoding = String(hop.headers['content-encoding'] || '').toLowerCase().trim();
+    let source = hop.stream;
+    let decoder;
+    if (!hop.decoded && encoding && encoding !== 'identity') {
+        const make = DECODERS[encoding];
+        if (!make) {
+            hop.stream.destroy();
+            throw new SafeFetchError('ERR_UNSUPPORTED_ENCODING', `unsupported content-encoding ${encoding}`);
+        }
+        decoder = make();
+        hop.stream.on('error', e => decoder.destroy(e));
+        source = hop.stream.pipe(decoder);
+    }
+    const declared = Number(hop.headers['content-length']);
+    if (onLimit === 'throw' && !encoding && Number.isFinite(declared) && declared > maxBytes) {
+        hop.stream.destroy();
+        throw new SafeFetchError('ERR_RESPONSE_TOO_LARGE', `response larger than ${maxBytes} bytes`, { limit: maxBytes });
+    }
+    const stop = () => {
+        decoder?.destroy();
+        hop.stream.destroy();
+    };
+    const onAbort = () => hop.stream.destroy(new SafeFetchError('ERR_TIMEOUT', 'request timed out'));
+    signal.addEventListener('abort', onAbort, { once: true });
+    const chunks = [];
+    let total = 0;
+    let truncated = false;
+    try {
+        for await (const chunk of source) {
+            total += chunk.length;
+            if (total > maxBytes) {
+                if (onLimit === 'truncate') {
+                    chunks.push(chunk.subarray(0, chunk.length - (total - maxBytes)));
+                    truncated = true;
+                    break;
+                }
+                throw new SafeFetchError('ERR_RESPONSE_TOO_LARGE', `response larger than ${maxBytes} bytes`, { limit: maxBytes });
+            }
+            chunks.push(chunk);
+        }
+    }
+    finally {
+        signal.removeEventListener('abort', onAbort);
+        stop();
+    }
+    return { body: Buffer.concat(chunks), truncated };
+};
+// ------------------------------------------------------------------
+// public API
+/**
+ * GET `input` and return { url, status, headers, body, truncated, redirects }.
+ *
+ * options:
+ *   timeout            idle/connect timeout per hop in ms (default 3000)
+ *   totalTimeout       hard deadline for the whole call incl. redirects (default 3 x timeout)
+ *   maxBytes           response cap in bytes, applied after decompression (default 1 MiB)
+ *   onLimit            'throw' (default) or 'truncate' when the cap is hit
+ *   maxRedirects       default 5
+ *   redirects          'any' (default) | 'same-host' | 'none'. Every hop is
+ *                      address-checked either way. https -> http downgrades
+ *                      are always refused.
+ *   headers            request headers
+ *   shouldReadBody     (status, headers) => boolean; return false to skip the body
+ *   allowPrivateNetworks  explicit opt-out of the address policy (default false)
+ *   lookup / isBlocked    injection points (host hooks, tests)
+ */
+export async function safeHttpGet(input, options = {}) {
+    const { timeout = SAFE_FETCH_DEFAULTS.timeout, maxBytes = SAFE_FETCH_DEFAULTS.maxBytes, onLimit = 'throw', maxRedirects = SAFE_FETCH_DEFAULTS.maxRedirects, redirects = 'any', headers: userHeaders, shouldReadBody, allowPrivateNetworks = false, lookup: customLookup } = options;
+    const baseLookup = customLookup ?? dns.lookup;
+    const totalTimeout = options.totalTimeout ?? timeout * 3;
+    const isBlocked = allowPrivateNetworks ? () => false : (options.isBlocked ?? isBlockedAddress);
+    const transport = nodeTransport({ lookup: createGuardedLookup({ lookup: baseLookup, isBlocked }), timeout });
+    const controller = new AbortController();
+    const deadline = setTimeout(() => controller.abort(), totalTimeout);
+    deadline.unref?.();
+    let url = normalizeUrl(input);
+    const origin = url;
+    let headers = { 'user-agent': 'node', accept: '*/*', 'accept-encoding': 'gzip, deflate, br', ...lowerHeaders(userHeaders) };
+    try {
+        for (let hops = 0;; hops++) {
+            const host = hostOf(url);
+            if (net.isIP(host) && isBlocked(host)) {
+                throw blockedError(host, host);
+            }
+            let hop;
+            try {
+                hop = await transport(url, headers, controller.signal);
+            }
+            catch (e) {
+                if (e instanceof SafeFetchError) {
+                    throw e;
+                }
+                if (controller.signal.aborted || e?.name === 'AbortError') {
+                    throw new SafeFetchError('ERR_TIMEOUT', 'request timed out');
+                }
+                // dns.lookup errors surface our SafeFetchError through
+                // the socket as the same object
+                throw e?.cause instanceof SafeFetchError ? e.cause : e;
+            }
+            const hopHeaders = lowerHeaders(hop.headers);
+            hop.headers = hopHeaders;
+            if (hop.status >= 300 && hop.status < 400 && hopHeaders.location) {
+                hop.stream.destroy();
+                if (redirects === 'none') {
+                    throw new SafeFetchError('ERR_REDIRECT_NOT_ALLOWED', 'redirects are not allowed');
+                }
+                if (hops >= maxRedirects) {
+                    throw new SafeFetchError('ERR_TOO_MANY_REDIRECTS', `more than ${maxRedirects} redirects`);
+                }
+                let next;
+                try {
+                    next = normalizeUrl(new URL(String(hopHeaders.location), url));
+                }
+                catch (e) {
+                    throw e instanceof SafeFetchError ? e : new SafeFetchError('ERR_INVALID_URL', 'invalid redirect target');
+                }
+                if (url.protocol === 'https:' && next.protocol === 'http:') {
+                    throw new SafeFetchError('ERR_REDIRECT_NOT_ALLOWED', 'https to http downgrade refused');
+                }
+                if (redirects === 'same-host' && !sameSite(origin, next)) {
+                    throw new SafeFetchError('ERR_REDIRECT_NOT_ALLOWED', 'redirect to a different host refused');
+                }
+                if (next.host !== url.host) {
+                    headers = Object.fromEntries(Object.entries(headers).filter(([k]) => !SENSITIVE_HEADERS.includes(k)));
+                }
+                url = next;
+                continue;
+            }
+            if (hop.status < 200 || hop.status >= 300) {
+                hop.stream.destroy();
+                throw new SafeFetchError('ERR_HTTP_STATUS', `request failed with status ${hop.status}`, { statusCode: hop.status });
+            }
+            if (shouldReadBody && !shouldReadBody(hop.status, hopHeaders)) {
+                hop.stream.destroy();
+                return { url: url.href, status: hop.status, headers: hopHeaders, body: Buffer.alloc(0), truncated: false, redirects: hops };
+            }
+            const { body, truncated } = await readBody(hop, { maxBytes, onLimit, signal: controller.signal });
+            return { url: url.href, status: hop.status, headers: hopHeaders, body, truncated, redirects: hops };
+        }
+    }
+    catch (e) {
+        if (controller.signal.aborted && !(e instanceof SafeFetchError && e.code !== 'ERR_TIMEOUT')) {
+            throw new SafeFetchError('ERR_TIMEOUT', 'request timed out');
+        }
+        throw e;
+    }
+    finally {
+        clearTimeout(deadline);
+    }
+}
+// ------------------------------------------------------------------
+// image sanity (pixel bombs)
+/** Reads width/height from PNG, GIF, JPEG and WebP headers without decoding. null if unknown. */
+export const readImageDimensions = (buf) => {
+    if (!Buffer.isBuffer(buf) || buf.length < 12) {
+        return null;
+    }
+    if (buf.readUInt32BE(0) === 0x89504e47 && buf.length >= 24) {
+        return { width: buf.readUInt32BE(16), height: buf.readUInt32BE(20) };
+    }
+    if (buf.toString('latin1', 0, 3) === 'GIF' && buf.length >= 10) {
+        return { width: buf.readUInt16LE(6), height: buf.readUInt16LE(8) };
+    }
+    if (buf.toString('latin1', 0, 4) === 'RIFF' && buf.toString('latin1', 8, 12) === 'WEBP' && buf.length >= 30) {
+        const kind = buf.toString('latin1', 12, 16);
+        if (kind === 'VP8X') {
+            return { width: 1 + buf.readUIntLE(24, 3), height: 1 + buf.readUIntLE(27, 3) };
+        }
+        if (kind === 'VP8L') {
+            const b = buf.readUInt32LE(21);
+            return { width: 1 + (b & 0x3fff), height: 1 + ((b >> 14) & 0x3fff) };
+        }
+        if (kind === 'VP8 ') {
+            return { width: buf.readUInt16LE(26) & 0x3fff, height: buf.readUInt16LE(28) & 0x3fff };
+        }
+        return null;
+    }
+    if (buf[0] === 0xff && buf[1] === 0xd8) {
+        let i = 2;
+        while (i + 9 < buf.length) {
+            if (buf[i] !== 0xff) {
+                i++;
+                continue;
+            }
+            const marker = buf[i + 1];
+            if (marker === 0xff) {
+                i++;
+                continue;
+            }
+            if (marker >= 0xc0 && marker <= 0xcf && marker !== 0xc4 && marker !== 0xc8 && marker !== 0xcc) {
+                return { height: buf.readUInt16BE(i + 5), width: buf.readUInt16BE(i + 7) };
+            }
+            if (marker === 0xd8 || (marker >= 0xd0 && marker <= 0xd7) || marker === 0x01) {
+                i += 2;
+                continue;
+            }
+            i += 2 + buf.readUInt16BE(i + 2);
+        }
+    }
+    return null;
+};
+//# sourceMappingURL=safe-fetch.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aunucore/baileys",
   "type": "module",
-  "version": "1.0.84",
+  "version": "1.0.85",
   "description": "AunuBaileys — the self-healing WhatsApp Web API for Node.js. Bad MAC and \"2000 messages into the future\" errors repair themselves, LID and phone-number identities stay in sync, anti-ban is built in, pairing codes are custom — plus 29 experimental features no other Baileys fork ships: invisible watermarks, per-person tag-all cards, side-profile text, ghost mentions and more. ESM, CJS and full TypeScript types.",
   "keywords": [
     "whatsapp",